EUVD-2026-105937
GHSA-4j56-vwp9-hhqg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged account on EM for Siebel
-
ExploitSend crafted HTTP request to Configuration Management
-
ExecutionExploit vulnerability for privilege escalation
-
ImpactAchieve full product takeover
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires a valid low-privileged account on the target (CVSS PR:L) plus network HTTP access to the Oracle Enterprise Manager for Siebel Configuration Management component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first authenticate with at least low-level credentials, and only the Enterprise Manager for Siebel product (not the broader Enterprise Manager platform) in supported versions 13.5 and 24.1 is affected, which combined with the product's niche deployment narrows the realistic attack surface. |
| Impact | This is a genuinely high-priority flaw by its intrinsic metrics: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full compromise of confidentiality, integrity, and availability ('takeover' per the description). However, the real-world exploitation signals are absent, not negative: there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is currently no evidence of active or imminent exploitation. The threat is therefore 'high potential, unproven activity' - treat it as a priority to patch during the normal Oracle CPU cycle, but the lack of a POC and KEV status means it is not yet an emergency on the level of a confirmed in-the-wild bug. One data tension worth noting: the metadata Tags label this 'Information Disclosure,' yet the CVSS vector and description both assert HIGH integrity and availability impact plus full product takeover, so the issue is substantially broader than disclosure alone - defenders should not scope remediation to data exposure only. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on the Oracle Enterprise Manager for Siebel instance reaches the Configuration Management component over HTTP and sends a crafted request that exploits the flaw, with no user interaction required. Because the CVSS vector indicates low attack complexity and high impact across all three dimensions, the result is full takeover of the Enterprise Manager for Siebel product. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged attackers who can reach Oracle Enterprise Manager for Siebel over HTTP can escalate to full takeover of the product's Configuration Management component in versions 13.5 and 24.1, per Oracle's October 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity, but a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not available in the supplied intelligence, so real-world risk currently rests on the intrinsic severity and the niche deployment footprint of the Siebel management plug-in.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor's patch vehicle for CVE-2026-101525 covering Enterprise Manager for Siebel 13.5 and 24.1; the available data does not specify an individual patch or bundle version number, so confirm the exact update level in the CPU patch matrix before closing the finding. Because exploitation requires only a valid low-privileged account, the highest-value compensating control while patching is credential and access hygiene: enforce least privilege on Enterprise Manager for Siebel accounts, remove or disable dormant and shared logins, and audit for accounts that hold Configuration Management privileges they do not need - the trade-off is administrative overhead and possible disruption to automated configuration jobs. Additionally restrict network reachability of the Enterprise Manager for Siebel HTTP interface to trusted management VLANs and jump hosts via firewall or reverse-proxy ACLs, which shrinks the AV:N path but will break legitimate remote administration from unmanaged networks. Where the Siebel management pack is not actively in use, consider disabling or not deploying the Configuration Management feature entirely, accepting the loss of configuration drift monitoring as the cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Enterprise Manager for Siebel is the Siebel-specific management pack layered on Oracle's Enterprise Manager platform, and the vulnerable surface is its Configuration Management component, which handles discovery, comparison, and reconciliation of Siebel application and middleware configuration across managed targets. Because the affected code is reached over HTTP (AV:N) with low attack complexity (AC:L) and only low privileges required (PR:L), the practical barrier is authentication rather than exploit sophistication; no CWE classification was supplied by the reporting source, so the root cause class cannot be pinned to a specific weakness (for example injection, missing authorization, or deserialization) from the available data. The scope is unchanged (S:U), so the impact is contained to the Enterprise Manager for Siebel application itself rather than the underlying host or the wider Enterprise Manager platform, though the high confidentiality, integrity, and availability ratings reflect that an authenticated user can read, alter, and disrupt managed configuration data and, per Oracle, achieve takeover of the product. The Siebel management pack is typically deployed only in organizations running Siebel CRM, which materially narrows the exposed population compared with the base Enterprise Manager platform.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description confirms network HTTP access by a low-privileged attacker with no user interaction and full takeover, so AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Enterprise Manager for Siebel versions 13.5 and 24.1 contain a high-severity flaw in the Configuration Management component that allows an authenticated low-privileged attacker with network access to escalate to full product takeover. Organizations running these versions-particularly where the management interface is reachable over HTTP-face potential confidentiality, integrity, and availability impact across a critical management plane, so leadership should prioritize exposure reduction and account governance while a vendor fix is pending. No public exploit identified at time of analysis, though the authenticated low-privilege requirement does not eliminate risk for exposed or broadly accessible management interfaces.
No vendor-released patch identified at time of analysis; restrict HTTP access to Oracle Enterprise Manager for Siebel 13.5 and 24.1 management interfaces to trusted networks, enforce least privilege and strong authentication, monitor low-privileged accounts for escalation attempts, segment the management plane, and apply the vendor patch immediately once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB